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(57) Abstract: A user gains access to a private nctworic by connecting to a network, cither through a hardwired or wireless con- 
nection, and then initiates an Internet access request targeting any website. If the user is not already authorized for Internet access, 
then the user is sent to a first predetermined website that points the user to an authentication server accessible via the Internet. The 
authentication server sends the user an HTTP form pages requesting authentication information. When the user responds, a network 
monitoring device within the private network alters the form page to include the user's hardware address and an encoded ID based 
on the network's location. The authentication server forwards this data to a gate keeper server, which authenticates the new user and 
transmits an unblock message along with another encoded ID based on the network's location and the user's hardware address. 
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SYSTEM FOR DISTtUBUTED NETWORK 
AUTHENTICATION AND ACCESS CONTROL 
BACKGROUND OF THE INVENTION 

1. Field of the Invention 

5 The invention relates to a computer method and system for performing user 

authentication and access control of data traffic at wireline and wireless entry points to the Intemet. 

2. Background of the Related Art 

The popularity of the Intemet has made a vast amount of information readily available to 
anyone with an Intemet connection. Intemet-enabled electronic mail has become an essential form of 

10 business communication. Currenfly, connections to the Intemet are predominantly made with landline 
access links such as dial-up modems, digital subscriber lines, and cable modems. 

These types of connections, although pervasive, offer limited mobility to a user and make 
the sharing of an Intemet connection difficult. For example, many libraries offer Intemet access at 
dedicated computer terminals and some universities provide network access jacks at multiple buildings on 

1 5 their campuses for convenient access by students using laptop computers. Both of these approaches dffer 
a means for accessing the Intemet at locations other than one's own landline access link, but both require 
that one remain stationary at the publicly-provided access point and both require a substantial 
infiastmcturc investment on the part of the institution providing the network coimection. Since it is not 
generally possible to have multiple users sharing the same network access jack or dedicated terminal, the 

20 institution must provide a separate access point for each patron it wishes to service. Additionally, those 
institutions offering access jacks to their network, such as universities, typically require that the user have 
a registered network account before being given access to the network, which further limits the network's 
accessibility to the public. 

Similarly, when a vendor visits a customer site on whose computer network the vendor 

25 does not have an account, the vendor will find it very difficult to gain access to the network, and hence to 
the Intemet, email accoxmts, and other vital data. Should the vendor be fortunate enough to gain access to 

1 
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a network jack, the vendor will still be at the mercy of the customer site's network administrator. For 
security reasons, it is customary for companies to set up their computer networks to d«iy access to 
anyone not already present in their access hst of registered users. 

Thus, mobile access to the Internet is limited by two factors. The furst is the physical 

5 requirement for a user to maintain a line connection to sparsely located network access jacks. The second 
is the difficulty in gaining access to a network on which one does not have a registered account. The first 
of these factors has begun to be overcome by tiie introduction of wireless data networks, which do not 
require that a user mj^iptain an access line plugged into a network access jack and thus do not require that 
the user remain stationary. Additionally, because the network connections are made wirelessly, it is 

10 relatively easy for multiple users to connect and disconnect fit)m a network using the same access point 
Overcoming the second factor is not so straightforward, and is addressed more fiilly below. 

An exan5>le of a currently widely available wireless data network is the low speed 
personal communication service (PCS) network. The primary access devices of this type of network are 
cellular telephones with built-in Wireless AppUcation Protocol (WAP) features. These wireless networks 

15 operate in a licensed frequency band, are centrally planned, and are built by large telecommunication 
carriers. Topically, each cell has a large radius of about 2-10 miles and operates at a slow speed of about 
19 Kbps. Jn any given geographical region there are only a handfiil of telecommunication carriers 
servicing the area, and each network is proprietary and closed to competing networks. Thus, to some 
degree one is not free to roam from one network to another. Additionally, their slow speed makes full 

20 access to the Internet ixnpractical and such network devices are typically restricted to abridged textual 
displays. 

An emerging new class of wireless data networks offer higher speeds of about 1-11 
Mbps. These networks operate in an unlicensed frequency band and are based on emerging wireless 
communication protocol standards such as IEEE 802. 1 1, Bluetooth and homeRF. A common 
25 characteristic of these types of networks is a small cell radius of about 200 feet. The cells are radio or 
infrared base stations that function as access points to a network. Several of these access points may be 
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distributed in close proximity to each other to expand the overall range of this type of wireless network. 
An introduction to such networks can be found in U.S. Patent Nos. 5,771,462 and 5,539,824. 

Various network configurations may be formed using fliese types of wireless network 
devices. FIG. 1 shows multiple computers 1 1 to 17 equipped with wireless network radio devices 
5 characterized by respective antemias 19-25. When computers 1 1 - 17 are within close proximity to each 
other, they can form a type of ad hoc network and conmiunicate among themselves. Absent from this 
type of ad hoc network, however, is a base station cell that can connect their ad hoc network to a wireline 
network having landline access to the iitemet. Therefore, this type of ad hoc network does not have 
access to the Litemet 

10 With reference to FIG. 2, in order to access the Memet, one needs to gain access to a 

network having a router 37 which in turn connects the network to the Internet 35. These types of 
networks are typically characterized by a server 3 1 which controls access to various services on the 
network, including Intemet services. Workstations 33 connect to the server 3 1 by means of various types 
of hardware cabling media 53. The network may provide wireless access points 41 and 43 to respectively . 

1 5 couple computers 47 and 49, which are equipped with wireless communication devices illustrated as 
anteraias, to the hardwired network controlled by server 3 1 . The access points 41 and 43 establish 
wireless connections with computers 47 and 49 by means of various communication systems such as 
radio and infrared waves, and have a hardwired connection to server 31 along cable 53. The function of 
access points 41 and 43 is to relay communication between server 31 and wireless network computers 47 

20 and 49 respectively, but server 3 1 still controls what services are provided to computers 47 and 49. Thus, 
server 31 may deny Intemet services to computers 47 and 49. Indeed, server 3 1 may refuse con^)uters 47 
and 49 entry to the network if they do not akeady have network accounts registered with server 3 1 . 

As was stated above, wireless networks have a short range, and so a second access point 
45 may be used to fimction as a repeater between a more distant wireless network computer Sl and access 

25 point 43. This is an example of using multiple base station access points 43 and 45 to extend the range of 
a wireless network. 



wo 02/11391 



PCT/USO 1/23453 



With reference to FIG. 3, many network layout configurations are known, and server 53 
need not be located between a routw* 55 and the other network nodes 61 to 65. In the network layout of 
FIG. 3, access point 67 has direct access to router 55, which in turn has access to the Intemet 59, but this 
does not mean that server 53 loses its control over the network. Regardless of the layout, server 53 may 
5 still be in charge of authenticating new users and assigning resources. Again, access point 67 is 

illustrated as a wireless access point due to its convenience in permitting multiple users 61 to 65 easy 
access to the network, but other hardwired access point connections are likewise typical 

In spite of their convenience, such wireless networks have been prohibitive in the past 
due to their relatively higih costs. Until recently, the components required to implement a wireless 
10 network had been costly, but recent developments in technology have begun lowering the price of both 
the cell base stations and radio devices needed to implement a wireless network. Such wireless networks 
are now becoming more prevalent in the industry, and Applicants envision a time when many small 
businesses may operate their own autonomous wireless networks. The size of these autonomous wireless 
networks could range from a city block, to a small building, to a coffee shop. It would then be possible 
15 for a mobile user to always have access to a wireless network by means of a mobile computing device 
' equipped with the proper radio communication devices. Thus, this type of wireless network would 
overcome the first factor limiting the free and mobile access to the Intemet discussed above. 

Nonetheless, one is still faced with the second factor mentioned above which restricts 
mobUe access to the Intemet. Since most autonomous wireless networks are independent, a mobile user 
20 would typically not be given access to a target network imless an access accoimt had been setup ahead of 
time for the mobile user on the target network. Even if a user had access accounts at multiple wireless 
networks, the user would have to stop his activities and re-authenticate on a different wireless network 
every time he moved from one autonomous network to another. 

Some prior art can be found in the areas describing methods of accessing foreign 
25 networks and methods of implementing multiple network transfers. U.S. Patent No. 5,878,127, for 

example, shows a telephone system that facilitates remote access to a private network from non-netwoirk 

4 
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locations or stations. The system authorizes remote access to the private network based on a calling party 
number of the non-network station and/or an authentication code entered by the remote calling party. 
U.S. Patent No. 6,016,3 18 describes various method of providing access to a private LAN and to the 
Internet via a "public mobile data network" including a location register, which serves as a database for 

5 storing location information of mobile data terminals and subscriber information. Along a similar note, 
U.S. Patent No. 5,978,373 shows a method by which a remote user can gain secure access to a private 
WAN. A central authentication office acts as a proxy to authorize a remote user and establish a secure 
connection to the private network. The central oflfice sends the remote user a service registration tmsplztG 
HTML file to be filled by the remote user. Once &e remote user has been authenticated, a connection is 

10 made with the private network. Similarly, U.S. Patent No. 5,918,019 shows a system by which aremote 
user, can establish a simulated direct dial-up connection to a private network via the Internet. 

U.S. Patent No. 6,000,033 describes a system wherein a user has accounts in naultiple 
databases with different passwords in each of the databases. To access all of the databases^ the user logs 
on to a master password database which then submits the appropriate password to whichever database 'the 

15 user wishes to access. U.S. Patent No. 5,872,915 shows a method of permitting secure access to software 
on a web server via the Intemet A usct enters data via a web browser, which is conununicated to the web 
server application. The web server application then authenticates the web browser, and passes 
appropriate input data to an application gateway, including data to uniquely identify the web browser. 
The application gateway then uses authentication data received from the browser to determine whether 

20 the user of fiie browser is authorized to access the software application. U.S. Patent 5,805,719 describes 
anotiier mefliod of authenticating a user wherein the system forgoes the use of ID tokens in favor of 
authorizing transactions by using the correlative comparison of a unique biometrics sample, such a finger 
print or voice recording, gathered directly from the person of an unknown user, with an authenticated 
biometrics sample of the same type obtained and stored previously. 

25 

SUMMARY OF THE INVENTION 



5 
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The above described methods of authenticating a user and increasing communication 
between foreign networks do not address the problem of permitting network access to a mobile user who 
does not have a registered account with a target network. Similarly, they do not discuss the infrastructure 
required to implement such a system. 
5 It is an object of the present invention to provide a system and method of permitting 

mobile users to gain Memet access via foreign data networks. 

It is another object of the present invention to provide a system of facilitating wireless 
access to the Internet even without the use of an intermediate private network. 

The above objects are met in a method of permitting distributed access control of 
10 computing devices across a plurality of small-radius data networks. The present invention, however, is 
not limited to small-radius data networks, and can be applied traditional hardwired, large-radius networks. 
A user wanting to gain access to a private network first makes a physical connection to the target 
network. The physical connection may be through a wireless base station, or may be through a wired 
hub, switch, or firewall. Once connected, the potential new user may then try to gain access to the target 
IS network's resources, such as Internet services. 

Typically, a private network would respond to a new user attempting to gain access to the 
network by &st attempting to verify the new user's identity and network privileges. If the new user is not 
among the private network's lists of authorized users, then the private network would have the choice of 
refusing the new user entry to the network or establishing a tenq)orary session with minimal privileges for 
20 the new user under a guest account If the new user were given a guest account, however, the private 

network would not have an accurate record of the new user's identity. Thus, most private network choose 
to refuse entry to any unregistCTed users. This type of network response is especially problematic in an 
envisioned distributed network consisting of multiple small private networks responsive to mobile 
individuals. The present invention seeks to alleviate fliis predicament by establishing a system by which 
25 new users in such "guest" accounts would be accurately identified. 
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This identification is useful not only for maintaining an accurate log of all users on a 
network, but also for billing purposes. For example, in a distributed network consisting of multiple small 
private networks, it may desirable to bill "guest" users for access time on a private network. In the 
present invention, this is accomplished by having a centralized authentication web server to which both a 

5 mobile user and a target private network subscribe. The mobile user creates an account with the 

authentication web server, including an identification means such as a password. The private network 
accepts the authentication results from the authentication web server and creates the appropriate limited 
network access for the new user. 

In operation, a client device (new user) physically connects to the target network via an 

10 access control device and initiates an Internet access request. If the client device is not among the target 
network's list of authorized users, the access control re-directs the client device to the authentication web 
server via the Internet The authentication web server sends the client device an HTML logon page 
through which the client device supplies the proper authentication information to the system. The 
. authentication device parses the information sent to it by the client device and authenticates the client 

15 device. If the client device is properly identified, then the authentication web server sends an "unblock" 
message to the access control device which is used exclusively for the specified client device. All further 
traffic from the client device flows through the access control device until an access expiration event 
happens, such as a timer ©cpiration, an explicit "disable client device" message, or a client device 
disconnected message. 

20 It is thus very important that the authentication web server be able to accurately identify 

both the client device and the target network. Due to the pervasive use of network address translation 
services in the industry, it cannot be assured that the IP addressing information received from the client 
device is accurate, nor would it be prudent to rely on identification information from the web browser, 
such as cookies, to establish the identity of the client device; otherwise the system would bcsusceptible to 

25 malicious use by software hackers. Therefore, the present invention establishes the identity of users by 
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using embedded IDs generated from the client device's and access point's hardware host addresses into 
reserved string fields of an HTML file. 

Additionally, since the present invention is interested primarily in providing Internet 
access to mobile users, the present invention proposes the use of enhanced remote access points having 
built-in router capabilities to directly connect a potential client user to the authentication web server and 
the fiitemet without the need of a private party's autonomous network. The authentication web server 
would maintain a record of the individual access points used and the names of the cUent users. Thus, the 
owners of the enhanced access points would still maintain an accurate record of all users for billing 
purposes. Alternatively, the client users could be billed or charged directly by flie auflientication web 
server and a percentage of Ihe billings sent to the owner of the enhanced access point used by flie client 
user. 

BRIEF DESCRIPTION OF THE DRAWINGS 
These and other objects, features and advantages of the present invention are better 

understood by reading the following detailed description of the preferred embodiment, taken in 

conjunction with the accompanying drawings, in which: 

FIGURE 1 is a prior art depiction of an ad hoc network using wireless communication; 
FIGURE 2 is a &st prior art network layout using both wireline and wireless network 

connections; 

FIGURE 3 is a second prior art network layout using both wireline and wireless network 

connections; 

FIGURE 4 is a prior art depiction of network communication using TP protocols; 
FIGURE 5 is a prior art depiction of the use of network address translation; 
FIGURE 6 is a first network layout in accord with the present invention; 
FIGURE 7 is a second network layout in accord wifli the present invention;, and 
FIGURE 8 is a block diagram of message flow in the first network layout. 
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DETAILED DESCRIPTION OF 
PRESENTLY PREFERRED EXEMPLARY EMBODIMENTS 
In order to facilitate the use of the present invention, the best mode of a presently 
prefeixed exemplary embodiment makes use of existing hardware and software tools with minimal 

5 modification to both. As it is known in the art, network communication processes are divided into 
multiple standardized stages, or layers, and each layer is assigned a specific task necessary for network 
communication. A widely used network communication standard is the Open System Interconnection 
(OSI) standard developed by the International Standards Organization (ISO). The OSI communication 
model divides network communication into seven layers. Each layer has a predefined, standardized 

10 mechanism for communicating with the layer immediately above it and immediately below it In this 
manner, any layer may be modified or optimized without requiring modification of any other layer as 
long as the same standardized mechanism is used to communicate with adjacent layers. 

The first layer is the physical layer and it describes the hardware medium for transmitting 
and receiving a logic 1 and a logic 0. The second layer is flie data link layer and it translates messages 

15 mto correct format for the physical layer to transmit, and translates messages received by the physical 
layer for upper layers to understand. Basically the data link layer formats messages into data frames that 
encapsulate the messages and adds customized information, including a CRC code, destination address 
information, and source address information. The third layer is the network layer and its main function is 
to direct data from a source network to a destination network. This Aird layer is sometimes called the 

20 latemet layer since its job is basically to route messages and provide a standard network interfece for 
upper layers. The present invention resides in fiiis fliird layer, and fliereby can be implemented wifli 
software modifications without requiring any additional hardware modifications. Since much of the 
existing hardware, such as routers and hubs, have updateable firmware, fee present invention may be 
easily assimilated into current networks. 

25 Various types of network protocols may be associated with the third layer of the OSI 

model, but the present invention preferably makes use of the Internet protocol, IP, which is the protocol 
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used by networks to communicate with the Litemet. It may therefore be advantageous to briefly describe 
the aspects further aspects of the IP addressing protocol relevant to the best mode of this preferred 
embodiment of the present invention before proceeding further in this discussion. 

With reference to FIG. 4, computer 71 is part of a first network 72 wishing to 

5 coimnunicate with computer 75 , which is part of a second network 79. The two networks 72 and 79 are 
coupled by router 74, which relays messages between the networks 72 and 79. Every node in a network 
has a unique hardware address, including side A of router 74, which communicates with computer 71, and 
side B of router 74, which communicates with con5)uter 75. When nodes within the same network target 
each other for communication, the sent messages are encapsulated with header information including the 

10 hardware and ff address of the source node and the hardware and IP address of the destination, or target, 
node. All nodes within the same network may pick up the message, but the message is ignored if the 
destination hardware address does not match iheir own. If the hardware address does match a particular 
node, then fliat node checks the IP address of the message to verify that fliey are indeed the intended 
receiver of the message. For example, if conq)uter 71 wished to send a message to router 74, flien the 

15 message header would include a source hardware address of 100, source IP address of 222.222.222. 1, a 
destination hardware address of 200 and destination IP address of 222.222222.2. If router 74 wanted to 
respond to the message then its response would include a similar header with the source and destination 
addresses interchanged. 

When messages must pass several networks to reach their destination node, the header 

20 information changes every time the message traverses a router. Nonetheless, the IP address of the 

destination node is maintained constant across the networks. As an exanaple, assuming that computer 71 
wishes to send a message to computer 75, the header of the information must relay the message through 
router 74. Therefore, the message leaving computer 71 will include a source hardware address of 100 and 
an IP address of 222.222.222.1, as well as the IP address of con^uter 75. However, since computer 75 is 

25 not within tiie same network as computer 71, the message will include the hardware address 200 of the 
router 74. The router 74 will pick up the message since the message has its hardware address, but upon 

10 
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inspection of the destination IP address will detemiine that the final destination is that of computer 75. 
Therefore, the router will forward the message to computer 75 with a new header. The new header will 
identify computer 71 as the originator of the message by maintaining its source IP address of 
222.222.222.1, but will identify router 74 as the sender of the forwarded message by listing the source 
5 hardware address 300 of side B of router 74. Since side B of router 74 faces the same network 79 as 
computer 75, the forwarded message will include the correct destination hardware and IP address of 
con:q>uter 75. When responding, computer 75 will know that the original source of the message was 
computer 71 because it IP address was preserved in spite having received the message from the router 74. 
This would be true no matter the number of routers the message had to traverse before reaching computer 

10 • 75. In this case, it can be seen that the source IP address in the header of a message can uniquely identify 
the originator of a message, whereas the source hardware address changes every time the message passes 
through a router and is thus not a reliable source for identifying the originator of &e message. It would 
seem therefore that ihc source IP address in the header of a message would be a prime candidate for 
identifying a specific node across multiple networks, as is required by the present invention. However, 

15 ' this is not the case if a message crosses a network making use of Network Address Translation (NAT) 
services to manage its access network nodes. 

In order for a node to access the Internet, the node must have a unique IP address. 
However, the number of unique IP address is limited and many networks make use of NAT services for 
permitting many network nodes, or network con^uters, to access the Internet using the same IP address. 

20 A simple example of network address translation is shown in FIG. 5. here, computers 72 

to 76 are part of a network that shares a single valid IP address, 201.1.2.3, by means of a network address 
translation n^nager 78. Each of computers 72 to 76 is given an arbitrary IP address that is unique within 
flie network, but is not necessarily a valid Intemet IP address. When any of computers 72 to 76 wants to 
access the hitemet 80, they mxist first through NAT manager 78, which relays the message to the Intemet 

25 with the correct IP address 84 and its own hardware address 104. Additionally, NAT 78 assigns a unique 
access port number to each incoming message from computers 72^76, and maintains a table associating 

11 
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the hardware and IP address of the originating source computer 74-76 with the assigned port nrnnber. 

This assigned port number is part of the identification data included in the header encapsulating a 

message, and is therefore sent along with the message to the Internet 80, When a message is received 

from the Intemet 80, the header information of the received message will list the IP and hardware address 
5 of NAT 78 as its destination data, but will also have the port number NAT 78 had assigned to the 

originally relayed message. NAT 78 uses this port number to identify which of computers 72-76 

originated the message and relays the response from the Intemet to the computers 72-76 accordingly. 

Thus in this case, a target web page within the Litemet 80 will not be able to identify the 

originator of a message since all messages coming from the network behind NAT 78 will have the same 
10 source IP and hardware address. Therefore, this preferred embodiment of the present invention chooses 
■ not to rely on the source IP address in the header of a message when trying to identify the network node 

that originated a message. 

A major object of the present invention is to be able to uniquely identify a mobile user no 

matter what type of network the user connects to in order to gain access to the Intemet Therefore, this 
15 : pieferred embodiment of the present invention deviates from the prior art when identifying the source of a 

mobile user. 

A fiist embodiment of a network system in accord with the present invention is shown in 
FIG. 6. The present invention may be utilized in a network having a layout similar to that of HG. 2 or 
any other known network configuration, but is preferred that an access point 123 in accord with the 
20 present invention be placed close to a network node with Intemet access. In FIG. 6, router 127 couples a 
source network 129 with the Intemet 131. Therefore, access point 123 is shown next to router 127. In flie 
present example, a mobile user utili2dng a laptop computer 121 cormects to network 129 using wireless 
access point 123. It is to be understood that a mobile user may also connect to network 129 by means of a 
hardware access jack 

25 Within network 129, server 125 is preferably in charge of authenticating all new users 

and allocating various network services, including Intemet access. In the present example, the mobile 

12 
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user accesses network 129 using a laptop computer 121 and access point 123, but does not have a network 
account with server 125 and would therefore typically be denied network access. Nonetheless, the mobile 
user initiates an Internet access session to a desired target web page 133 by means of almost any web 
browser, such as Microsoft Internet E>qplorer, Netscape Navigator, etc. The mobile user device 121 thus 
5 goes througji its domain name resolution process to identify the address of target web page 133. Network 
129 will permit all DNS traffic to the Intemet, even from unauthorized user, and the mobile user thus 
receives the correct IP address of its target web page 133. 

As is known in the art, a TCP connection is started by a source host sending a SYN, i.e., 
synchronize/start, packet to a destination host and then waiting for a synchronize acknowledge (SYN 

10 ACK). In the present case as shown in FIG. 8, however, when mobile user device 121 attempts to open 
an HTTP connection to the target device 133 by sending a TCP SYN packet to the target web page 133 
using the acquired destination IP address in Step 1, network 129 intercepts the packet and checks if the 
mobile user device 121 is authorized to gain access to the Intemet. If it is, then the message is forwarded 
accordingly. If the mobile user device is not authorized, tiien the packet is re-routed to a predetermined 

15 redirection web server 139. Redirection web server 1 39 responds in Step 2 by transmitting a "Web Site 
Relocated" message that points the mobile user device 121 to an authentication web server 137 (this 
redirection ability is conventional to HTML, a common language for encoding web pages). The mobile 
user's web browser responds to the "Web Site Relocated" message by automatically re-sending the HTTP 
request to authentication web server 137 in Step 3. Again, network 129 intercepts the TCP SYN packet, 

20 but upon recognizing that the target website is now the authentication web server 1 37, Ihe packet is 
forwarded without alteration. 

Thus, network 129 does not prohibit Intemet access by unauthorized users, it merely 
restricts it to a limited number of predetermined websites. Intemet access requests to a preauthonzed 
website, such as authentication web server 137, are permitted access to the Internet, but all latemet 

25 requests to unauthorized websites are automatically re-routed to redirection server website 139. 

13 
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In Step 4, authentication web server 137 presents the mobile user device 121 with an 
HTTP form page soliciting authentication information from the mobile user. The user-supplied 
authentication infonnation may include a user ID and password, which the user enters via his web 
browser. At this point, it should be noted that although the mobile user ID has been given an IP address 
5 by network 129 in order to communicate witWn flie network, the Internet packet transmitted from the 
mobile user device 121 to authentication web server 137 may not be relied upon to uniquely identify 
mobile user device 121 because of the possible use of network address translation by network 129. To 
overcome this limitation, the HTTP form page transmitted to the mobile user device 121 includes an 
embedded reserved field preceded by a unique client device ID keyword EFl provided by the 

10 authentication web server 137. The reserved field may be located within the out-going data packet a 
predetennined nimiber of bytes away from the unique client device ID keyword EFl . Alternatively, the 
reserved field may be immediately preceded by the unique client device ID keyword EFl. 

When the mobile user device 121 forwards its authentication data to authentication web 
server 137 in Step 5, network 129 detects that a message packet is bemg sent to authentication web server 

15 137 and responds by inspecting the message packet to detect the embedded reserved field. Since the 

message has come diiectty from mobile client device 121, its unique hardware address in the header of its 
message packet is still valid. Network 129 responds by generating a new client device ID keyword EF2 
based on the unique hardware address of mobile client device 121, the current session information, and 
the address infonnation of network 129. This address information will be dependent on the device on 

20 which the present system is implemented. This new client device ID keyword is inserted into the 

embedded reserved field and the modified message is forwarded to the authentication web server 137 in 
Step 6. 

Upon receiving the HTTP form page from user mobile device 121, authentication web 
server 137 parses the information in the HTTP form page. Preferably, the information is parsed using a 
25 backend CGI script. The authentication web server 137 forwards the user-supplied information and the 
new client device ID keyword from the embedded reserved field to a gate keeper server 135 in Step 7. 

14 
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The gate keq)er server may be accessed via the Ihtemet, or may be directly comiected to the 
authentication web server 137. Preferably, the infonnation is transmitted from the aufcentication web 
server 137 to the gate keeper server 135 along a secxired link. 

It should be noted that server 125, redirection web server 139, authentication web server 
5 137 and gate keeper server 135 need not reside on separate machines, and one or more of these may be 
co-resident on a machine. Further, these need not be servers in the usual sense of the word and may 
instead be web pages, scripts, applets or other routines capable of performing the attributed functions. 
Additionally, the ftmctionality of redirection web server 139 need not be separate and may be integrated 
into the network 129. 

10 The gate keeper server 1 35 processes the received authentication data information and 

checks if the user is registered. If the mobile client has a legitimate account, then the gate keeper server 
135 decodes the new client device ID keyword that is in the embedded reserved field to determine the 
. hardware address of the mobile user device 121. Hie gate keeper server 135 then sends an encrypted 
"unblock" message in Step 8 based on the same client device ID keyword to network 129. As explained 

15 above, the controllmg device within network 129 on which the present system is running had inserted the 
address information of mobile user device 121 in the HTTP form page, therefore gate keeper 135 sends 
the "unblock" message directly to this controlling device. Preferably, the "unblock** message is encrypted 
with the new chent device ID keyword. Alternatively, a third cUent device ID keyword may be generated 
and used for the encryption process. It may include the hardware address of the mobile client device 121, 

20 as well as the fiitemet protocol address of the network 129. 

Network 129 verifies the encrypted "unblock" message, and flien updates its internal 
access list to grant Internet services to the mobile client device 121. All subsequent traffic from the 
mobile client device 121 to the Ihtemet are forwarded by network 129 unimpeded until either an allowed 
access time expires as described in greater detail below, an explicit "Disable client device" message is 

25 received, or the client device 121 disconnects from network 129. 

15 
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In the description of FIG. 6, the present invention is described as a program routine 
running in network 129, but the location of the program routine was not expHcitly stated. The present 
invention may be a program routine running in server 125, router 127 or access point 123, or parsed to 
have its routines distributed among all three. 
5 Thus, all mobile users on network 129 are uniquely identified and verified. It is then 

possible for network 129 to charge a mobile user for access time on network 129. Alternatively, since the 
mobile user is authenticated by the gate keeper server 135, it may be advantageous that the gate keeper 
server 135, or another specialized server record the amount of time that mobile user device 121 spends 
accessing the Internet 131 through network 129, and charge accordingly. In still an alternate 

10 . embodiment, a mobile user will have aheady paid in advance for a predetermined amount of network 

access time as noted above. When a mobile user is admitted access to a private network, such as network 
129, the amount of time paid in advance is transmitted to network 129, which then disconnects mobile 
user 123 once the time has expired. Any remaining time not used by mobile user device 123 may be 
forward to the gate keeper server 135, or the corresponding specialized server, and the remaining time on 

15 . Jthe user's account may be updated accordingly. 

An altemate embodiment of the present mvention is shown in FIG. 7. Elements in FIG. 7 
similar to those of FIG. 6 have similar reference characters and are described above. In the present 
altemate embodiment, access points 105 and 1 1 1 have routing capabilities for coimecting to the Ihtemet 
131. Thus neither of access points 105 or 111 require a separate hardwired network, such as network 129 

20 shown in FIG. 6, to implement the present invention. 

For illustrative purposes, wireless access point 105 is shown located in a coffee shop and 
wireless access point 11 1 is shown located in the waiting room of an automotive mechanic's shop. 
Mobile users may then access the Ihtemet 131 via wireless access point 105 and any known device for 
establishing a node connection to a network, such as a handheld computing device 1 0 1 or laptop 

25 computer 103. In the present example, access point 105 is shown as a wireless access device, but it may 
also provide hardwired connections to client devices. Similarly, a mobile user may use laptop computer 

16 
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109 to access the luteraet 13 1 via wireless access point 1 1 1 . Li this embodiment, it may be preferable for 
gate keeper server 135 to maintain a record of Internet access time by devices 101, 103 and 109, and then 
to send a summaiy report to the owners of wireless access points 105 and 111. 

The present invention has been described above in connection with a preferred 
5 embodiment thereof; however, this has been done for purposes of illustration only, and the invention is 
not so limited. Indeed, variations of the invention will be readily apparent to those skilled in the art and 
also fall within the scope of the invention. 
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WHAT IS CLAIMED IS: 

1. A system for controlling Ihtemet access on a network, said system 

comprising: 

at least one access device for connecting to said network and for originating out- 
going data packets, each of said at least one access device being characterized by a unique 
hardware address; 

a redirection server accessible via the Internet; 

a network monitoring device for monitoring out-going data packets sent from 
said network to the Internet and for verifying if an originator access device of an out-going data 
packet is authorized for Internet access, all out-going packets originated from authorized access 
devices being forwarded unimpeded to the Litemet and all out-going data packets originated from 
unauthorized access devices be being inspected for determination of their target destination 
Internet websites, and for checking if a determined target destination Internet website matches a 
predetermined authentication server website and forwarding a corresponding out-going data 
packet to said predetermined authentication server if a match is foimd, said network monitoring 
device responding to a match not being found by disregarding the determined destination Intemet 
website and forwarding the out-going data packet to said redirection server; 

whereby all out-going data packets to the Intemet gain access to the Intemet 
irrespective of whether their respective originator access devices are authorized for Ihtemet 
access. 

2. The system of claim 1 wherein said redirection server responds to a received 
data packet from an unauthorized originator access device by sending said originator access 
device a message instructing it to connect to said predetermined authentication server. 

3. The system of claim 1 wherein said authentication server responds to an 
unsoUcited received data packet by sending an originator access device of said data packet a 
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questionnaire form soliciting authentication information, said questionnaire form including a 
hidden reserved field and a first identification keyword. 

4. The system of claim 3 wherein said hidden reserved field is not accessible by 
said originator access device which receives said questionnaire form. 

5. The system of claim 3 wherein said first identification keyword is based on 
address information fix)m said network monitoring device. 

6. The system of claim 3 wherein said network monitoring device, after 
verifying that said determined target destination Intemet website matches said predetermined 

' authentication server and before forwarding the out-going data to said predetermined 
authentication server, fiirfher scans contents of said out-going data packet in search of said first 
identification keyword and upon locating said first identification keyword, gaierates a second 
identification keyword based on the unique hardware address of the originator access device, said 
second identification keyword being inserted in said hidden reserved field. 

7. The system of claim 6 wherein said second identification keyword is 
additionally based on current communication session information. 

8. The system of claim 6 wherein said second identification keyword is 
additionally based on location information of said network monitoring device. 

9. The system of claim 6 wherein said hidden reserved field is located within 
said out-going data packet a predetermined nxmiber of bytes away jfrom said first identification 
keyword. 

10. The system of claim 6 wherein said hidden reserved field is immediately 
preceded by said first identification keyword within said out-going data packet. 

1 1 . The system of claim 3 wherein said originator access device receiving said 
questionnaire form uses web browsing software to supply said solicited authentication 
information into said questionnaire form before transmitting the questionnaire form back to said 
authentication server via the Litemet. 
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12. The system of claim 1 wherein said authentication server responds to a 
solicited data packet having a hidden reserved field by extracting the contents of said hidden 
reserved field and authentication information from said solicited data packet, the extracted 
information being sent to a gate keeper server. 

13. The system of claim 12 wherein said gate keeper server is accessible via the 

Intemet. 

14. The system of claim 12 wherein said authentication server uses a CGI script 
to parse said extracted information from said solicited data packet. 

15. The system of claim 12 wherein said gaite keeper server compares said 
authentication information with a predefined database to determine if said originator access 
device is registered, and responds to the verification of the originator access device being 
registered by sending an unblock message to said network monitoring device. 

16. The system of claim 15 wherein said unblock message is encrypted with said 
second identification keyword. 

17. The system of claim 15 wherein upon verification of the originator access 
device being registered, said gate keeper server decodes contents of said hidden reserved field to 
determine the unique hardware address of said originator access device and labeling said unblock 
message with said hardware address. 

1 8. The system of claim 1 5 wherein said network monitoring device responds to 
receipt of said imblock message by updating a network access hst to authorize said originator 
access device for Intemet access. 

19. A system for remotely authenticating a user on a private network via the 
Intemet, the system comprising: 

a netwo± access device for permitting said user access to said private network, 
said access device being characterized by a unique hardware; 

an authentication server accessible via the Intemet; 
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a network monitoring device for monitoring the destination address of all out- 
going messages from said private network to the Internet and for scanning the content of any 
message whose destination is said authentication server to search for a first predetermined 
identification code in said message, said network monitoring device responding to the detection 
of said first predetermined identification code by determining the hardware address of the access 
device fliat originated the message and generating a second identification code based on said 
hardware address, said network monitoring device further inserting said second identification 
code in said message before forwarding said message to said authentication server; • « 

said authentication server responding to receipt of said forwarded message from 
said network monitoring device by decoding said hardware address from said second 
identification code; a third identification code based on said hardware address being generated 
and transmitted along with an unblock message to said network monitoring device. 

20. The system of claim 19 wherein said network monitoring device responds to 
said unblock message by updating a network access list to authorize for Internet access the user 
whose network access device has the same hardware address as is embedded in said third 
identification code. 

21. The system of claim 19 wherein said second identification code is further 
based on the Internet protocol address of said network monitoring device. 

22. The system of claim 19 wherein said third identification code is fiirflier 
based on the Internet protocol address of said network monitoring device. 

23. The system of claim 19 wherein said network monitoring device responds to 
the absence of said first predetermined identification code in a message whose destination is said 
authentication server by forwarding said message to said authentication server with no 
modification to said message. 

24. The system of claim 19 wherein said network monitoring device is further 
effective for verifying if an out-going message is originated by an authorized user and permitting 
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all out-going messages from authorized users unimpeded access to the Internet, all messages from 
unauthorized users having their destination addresses inspected to determined if their destination 
is said authentication server, and responding to a destination address other than said 
authentication server by ignoring the destination address and forwarding the message to a 
predetermined redirection server via the Internet; 

whereby all out-going messages to the Internet are granted access to the Internet 
irrespective of whether the message is originated by an unauthorized user. 

25. The system of claim 24 wherein said redirection server responds to a 
received message from an unauthorized user by sending the user's network access device a 
message instmcting it to connect to said authentication server. 

26. The system of claim 19 wherem said authentication server responds to a 
received message lacking said second identification code by generating said first predetermined 
identification code based on location information of said private network, said authentication 
server further sending the network access device that originated the message a questionnaire form 
soliciting authentication information from its respective user, said questioimaire form including a 
hidden reserved field and said first predetermined identification code. 

27. The system of claim 26 wherein said hidden reserved field is not accessible 
by the user tibiat receives said questiomiaire form. • 

28. The system of claim 26 wherein said hidden reserved field is preceded by 
said first predetermined identification code in said questionnaire form. 

29. The system of claim 26 wherein said network monitoring device inserts said 
second identification code in said hidden reserved field of any messages sent by a user to said 
authorization server. 

30. The system of claim 26 fiirther having a gate keeper server, said 
authentication server fiirther being able to identified filled questionnaire forms received from 
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unauthorized users and being effective for parsing out the user's authentication information along 
with said hardware address from said second identification code; 

said authentication information and hardware address being relayed to said gate 
keeper server for verification, said gate keeper server responding to the verification of an 
unauthorized user by generating said third identification code and transmitting said unblock 
message to said network monitoring device, 

3 1 . The system of claim 30 wherein said gate keeper is accessed via a secure 
link from said authorization server. 

32. The system of claim 30 wherein said authorization server accesses said gate 
keeper server via the Internet. 
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FIG. 1 



wo 02/11391 



2/8 



PCT/USOl/23453 




wo 02/11391 



3/8 



PCT/USOl/23453 




FIG. 3 

(PRIOR ART) 
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FIG. 4 

(PRIOR ART) 
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FIG. 6 
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FIG. 7 



